---
title: "Scan for Domain Siblings"
slug: "scan-for-domain-siblings"
description: "Threat actors use domain siblings to impersonate a legitimate domain or website in order to deceive users and steal sensitive information."
tags: ["Domain queries"]
updated: 2025-12-31T16:52:50Z
published: 2025-12-31T16:52:50Z
canonical: "help.silentpush.com/scan-for-domain-siblings"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan for Domain Siblings

Domain Siblings are domain names that share the same second-level domain as a target domain but have different top-level domains (TLDs). For example, if the target domain is **example.com**, its domain siblings might include **example.net**, **example.org**, and so on.

Domain siblings can be used in various ways, both legitimate and malicious. An organization may register multiple domain names that share the same second-level domain name to redirect traffic or protect its brand; however, threat actors may use domain siblings to impersonate a legitimate domain or website, deceiving users and stealing sensitive information.

## Scan for siblings

1. From the left navigation menu, select **Advanced Query Builder >** **Domain Queries > Siblings**.
2. Specify a **domain**.
3. Click **Search**.

## Save Query

1. Specify query parameters.
2. Click **Save Query**.
3. Provide a **Name** and **Description** for context.
4. Click **Save**. The query appears in [**Private Queries**](https://help.silentpush.com/docs/private-queries).

This protects against TLD variant attacks.

Domain names sharing the same second-level domain as a target domain but with different top-level domains(TLDs), potentially used for brand protection

or malicious impersonation, are identified through targeted queries.